Network routing between two express route circuit with Azure Firewall

Romain 45 Reputation points

Hello Guys,

I have a customer who need to have 2 express route circuit connected to two different data center (so one circuit for each DC) connected to a same Azure Vnet Gateway within a classic HUB and spoke azure environment.

Within the HUB Vnet they have an Azure Firewall implemented and they would like to be able to do transitive routing between these 2 express route circuit and being filtered by the Azure Firewall.

I searched in microsoft documentation but didn't found lot of details to see if this setup could work or not.

Is it the correct way to go or their is a better way ?

Thanks a lot in advance.


Azure VPN Gateway
Azure VPN Gateway
An Azure service that enables the connection of on-premises networks to Azure through site-to-site virtual private networks.
1,150 questions
Azure Firewall
Azure Firewall
An Azure network security service that is used to protect Azure Virtual Network resources.
478 questions
Azure ExpressRoute
Azure ExpressRoute
An Azure service that provides private connections between Azure datacenters and infrastructure, either on premises or in a colocation environment.
246 questions
{count} votes

Accepted answer
  1. msrini-MSFT 8,341 Reputation points Microsoft Employee


    Yes, your setup will work. When you connect 2 circuits to the same VNET, the routes from each circuits are learnt by ER Gateway and are exchanges to the circuits. Transitive connectivity between DCs will be established.

    User's image

    You can think of ER Global reach to reduce extra hops and latency. If your intension is to use Firewall to filter traffic between 2 DCs, then your design should work.


    Karthik Srinivas

1 additional answer

Sort by: Most helpful
  1. Romain 45 Reputation points


    Thanks for the quick update, so you would suggest to have two different vnet gateways (in two others vnet) and the Firewall within a hub vnet ?

    I had this kind of setup in first place but are you sure transitive routing between two different vnet gateways will be possible in this kind of setup ?



    0 comments No comments